基于网络/主机副本法的诱骗系统的研究与实现  

Research and implement of network deception system based on network/host copy

作　　者：赖海明[1] 张建忠[1] 

机构地区：[1]南开大学计算机科学与技术系,天津300071

出　　处：《计算机工程与设计》2007年第9期2008-2011,共4页Computer Engineering and Design

摘　　要：分析比较了现有的网络诱骗技术及其优缺点,在采用网络/主机副本方案的基础上,提出了一种基于Linux动态进程共享库注射的数据捕获方法。系统主要分为诱骗客户端和服务器两个部分,客户端主要负责数据捕获和数据发送,服务器端将获得的数据存储并分类显示,显示方式包括命令行和图形界面。系统还采用了用户态—内核态通信、内核态发包、内核模块隐藏等技术。Current network deception technologies are analyzed and compared. On the basis of adopting network/host copy scheme, a kind of data captured method based on Linux dynamic process shared library injection is proposed. This system is divided into deception client and server. The client is responsible for capturing and sending data; the server will store and display them either on command line or on graphic UI. This system also adopts some technologies such as communications between user space and kernel space, sending package from kernel mode, kernel module hiding, etc.

关 键 词：网络/主机副本 网络诱骗 共享库注射 内核模块 netlink套接字 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]